maryland emergency management agency - continuity of ... · web viewhave all key elements of the...

CONTINUITY OF OPERATIONS (COOP)REVIEW WORKSHEETS

Reviewer Name:

Reviewer Email:

Agency Plan:

Lawrence J. Hogan, GovernorRussell Strickland, Maryland Emergency Management Agency Executive DirectorMay 2015 - Version 2.1

REVIEW WORKSHEET INSTRUCTIONS

This Review Worksheet contains instructions that may be helpful in reviewing the COOP plan. These instructions are in italics to distinguish them from other parts of the review.

Use the box below to provide overall comments for the entire COOP plan.

On the following pages, for each sub-section:

● Briefly describe or list where in the plan the relevant COOP element is found● Provide comments as necessary● Answer each question “yes” “no” or “not applicable” by placing an "X" in the appropriate column● Provide recommendations as necessary

The last pages of this document contain a separate Worksheet that should be completed for plans that have a Pandemic Influenza Annex.

Maryland Emergency Management Agency 2 | PageCOOP Plan Review Sheets

OVERALL COMMENTS

In this section address the overall readability and effectiveness of the COOP Plan. Is the COOP Plan realistic? Does the COOP Plan include an overwhelming amount of Essential Functions?

For the longer or more complex plans it is a good idea to encourage the use of job aides (tables to place in an appendix that capture all the information for an Essential Function in one place). That way employees who run Essential Functions can have access to the information they need, as very few employees read a 500 page COOP plan.

Is the COOP Plan scalable? Can this COOP Plan be tiered or phased-in if necessary? Is it clear which aspects of the COOP Plan will be activated if it is scalable? COOP plans should plan for the worst but must also be useful when the “not so bad” happens as well.


REVIEW OF GENERAL COOP PLAN

COOP Element

Location in

the COOP Plan

Reviewers CommentsYes

No

N/A

Recommendations

1.0 PLAN DEVELOPMENT & IMPLEMENTATION

1.1

Is there a COOP program point of contact (POC) and COOP team designated? This information should be in a table that is located towards the beginning of the document.

1.2

Have all key elements of the Agency (program managers, facilities, information resource management, security, telecommunications, records management, public affairs, emergency response agencies, and senior management) been involved in the planning process?


2.0 PROGRAM PLAN & PROCEDURES

2.1

Is there sufficient capability to conduct procurement actions, keep financial records, record time and attendance, and perform other essential administrative support functions? Does the COOP Plan account for continuity of payroll?

2.2

Is there a plan for protection and recovery of vital systems and equipment?

2.3

Does the COOP Plan include vendor contacts for non-vital record related equipment (not IT) as well as account numbers and any other information necessary, such as access codes or keys to the equipment?

2.4


Does the COOP Plan include IT restoration contacts, account numbers, and any other information necessary to restore IT?

2.5

Do many different departments list the same person/resource to help with IT restoration? This may be a weakness if the same person/resource would be unable to manage all departments at once.

2.6

Does the Agency’s main facility maintain emergency/back-up power capability, so that Essential Functions and operations continue in the event the primary source of power is disrupted?

2.7

Do the Agency’s activation and relocation plans or procedures


include a decision matrix for continuity plan activation and implementation for events that are with warning, without warning, that occur during duty hours, and also during non-duty hours?

2.8

Does the COOP Plan include an agency organizational chart? For both the COOP Team as well as the Agency?

2.9

Does the COOP Plan include an Incident Command System (ICS)?

3.0 ESSENTIAL FUNCTIONS: The limited set of agency-level functions that should be continued throughout, or resumed rapidly after, a disruption of normal activities. A subset of overall agency activities that are determined to be critical. These functions enable the agency to provide vital services, exercise civil authority, maintain the safety of the community, and sustain the industrial/economic base during an emergency. The functions must be continued under any and all circumstances.

3.1

Has the Agency identified its Essential Functions and documented them in its COOP Plan?


3.2

Has the Agency prioritized its Essential Functions, by number or general categories? Does the Agency seem to include too many high priority Essential Functions?

3.3

Has the Agency reviewed its Essential Functions to determine those directed by applicable laws and statutory authorities? Agencies should ensure that their outlined Essential Functions include functions required by the Agency’s Enabling Statute.

3.4

Has the Agency head or designee validated and approved the identified Essential Functions? This is indicated by the executive signature(s) in the beginning of the plan. If the Agency did not use the Maryland template, then the agency planners should add a


signature/approval page.

3.5

Has the Agency identified those Essential Functions that provide interdependent support to an Essential Function performed by another agency? Agencies should document any listed functions that support other state agencies and/or local jurisdictions. Details should include the function and the agency/jurisdiction it supports. Suggest the Agency include this in an appendix, along with the information in 3.6.

3.6

Has the Agency identified those Essential Functions that require vital support from another agency to ensure the execution of its mission? Agencies should document which functions are interdependent on which outside agencies and/or entities. Suggest the agency include this in an appendix, along with the information


in 3.5.

4.0 ORDERS OF SUCCESSION: Provisions for the assumption of senior agency offices during an emergency in the event that any of those officials are unavailable to execute their legal duties. Provisions that enable an orderly and predefined transition of agency leadership positions if an agency's leader is incapacitated or becomes otherwise unavailable during a continuity event.

4.1

Are the Orders of Succession for the position of the Agency’s head identified and current, with procedure for the revisions distributed to the Agency’s personnel as changes occur?

4.2

Are the Orders of Succession for other key positions for the Agency, including but not limited to administrators, regional or field directors, key managers, other key essential personnel or their equivalent positions, identified in the COOP Plan and current?

4.3

Is the Order of Succession at least three positions deep, including the devolution to counterparts when


applicable, and geographical disbursement where feasible? The Agency should have three successors to a position.

4.4

Does the Agency describe its Orders of Succession by positions or titles, rather than by the names of the individuals holding those offices? Using names and titles is acceptable, but the titles are required

4.5

Does the Agency include the method used to notify successors of their change in leadership status in its Orders of Succession procedures?

4.6

Does the Agency conduct annual successor training for all personnel who assume the authority and responsibility of the Agency’s leadership and other key personnel?

5.0 DELEGATIONS OF AUTHORITY: Specify who is authorized to act on behalf of the agency's chief, chairman, elected leader, and other key leaders for specified purposes. They ensure that designated individuals have the legal authority to carry out their duties. Also specify who


has authority to hire or terminate employees and bind the agency in contract. Authority may be administrative, legal, or emergency. Plans should set limits on delegated authority and also state what procedures are needed in order to delegate authority.

5.1

Does the Agency’s Delegation of Authority document, in advance, (where designated) the legal authority for officials (including those below the level of the Agency’s head) to make key policy decisions during a continuity situation?

5.2

Are the Agency’s Delegations of Authority written in accordance with applicable laws ensuring that the Agency’s Essential Functions are performed?

5.3

Do the Agency’s Delegations of Authority delineate the limits of and any exceptions to the authority and accountability for officials?

6.0 CONTINUITY (ALTERNATE) FACILITIES: Locations from which the agency leadership and critical positions may operate during a continuity event. This may include one or many facilities or virtual offices (including telework) from which to continue essential operations.


6.1

Does the COOP Plan identify and maintain at least one alternate facility, which could include alternate usages of existing facilities or virtual office options, for the relocation of key leaders and staff?

6.2

Does the Agency have a signed Memorandum of Agreement (MOA)/Memorandum of Understanding (MOU) for all alternate facilities where it is co-located with another agency or for alternate facilities it neither owns nor leases, as applicable?

6.3

Do all the Agency’s alternate facilities include considerations for health, safety, and security of employees who have been relocated to the alternate sites, to include food, water, and hygiene products in sufficient quantities to sustain operations until normal business activities can be


resumed?

6.4

Do the Agency’s alternate facilities (including virtual office options such as telework) include reliable logistical support, services, and infrastructure systems (e.g. information technology technical support)?

6.5

Does the Agency have procedures established for the orientation of continuity personnel on the alternate facilities? Do employees know where to go and how to get started?

6.6

Do the Agency’s activation and relocation plans include procedures for the notification of alternate facilities and the facilities’ management staff?

6.7


Do the Agency’s alternate facilities (including virtual office options such as telework) have pre-positioned or detailed site preparation and activation plans in order to achieve full operational capability within 12 hours of notification?

6.8

Does the COOP Plan detail how the Agency will transport necessary files and equipment to the alternate facility? This may not be applicable if all files and equipment are pre-positioned at the alternate facility. Consider license or permit restrictions on drivers.

6.9

Do the Agency’s alternate facilities maintain emergency/back-up power capability, so that Essential Functions and operations continue in the event the primary source of power is disrupted?

6.10


Does the COOP Plan define how employees will travel to and from the facility? From the main site and/or from the employee’s home?

6.11

Does the COOP Plan address housing to support continuity personnel at or near the alternate facility sites?

7.0 CONTINUITY COMMUNICATIONS: The systems that support full connectivity among the agency's leadership, internal elements, and other agencies to perform Essential Functions during a continuity event.

7.1

Does the COOP Plan identify the modes of communication that support the Essential Functions?

7.2

Does the COOP Plan identify alternate modes of communication and when they are to be used?

7.3

Does the COOP Plan include communication restoration contacts,


account numbers, and any other information needed to restore communications?

7.4

Do many different departments list the same person/resource to help with communication restoration? This may be a weakness if the same person/resource would be unable to manage all departments at once.

7.5

Does the COOP Plan detail a chain of communication among Agency employees? For example call trees or Rapid Recall List?

7.6

Does the COOP Plan detail a chain of communication for external vendors/organizations?

7.7

Does the Agency have a signed agreement between other agencies sharing a continuity facility, ensuring


that each one has adequate access to communications resources?

7.8

Does the Agency maintain fully capable continuity communications that could support the Agency’s needs during all hazards, including a pandemic and other related emergencies, giving full consideration to supporting social distancing operations including telework and other virtual offices?

8.0 VITAL RECORDS MANAGEMENT: The identification, protection, and availability of information systems and applications, electronic and hardcopy documents, references, and records needed to support Essential Functions during a continuity event.

8.1

Does the Vital Records Program identify and protect those records that specify how the Agency will immediately operate and continue to operate during a continuity situation? (Emergency Operating Records)

8.2


Does the Vital Records Program identify and protect those records needed to protect the legal and financial rights of the Agency and citizens? (Rights and Interests Records)

8.3

Does the Agency maintain a complete inventory of vital records along with locations of and instructions on accessing those records?

8.4

Are there procedures listed so that the vital records, at a minimum, are annually reviewed, rotated, or cycled so that the latest version will be available?

8.5

Is the Agency inventory of vital records maintained at an alternate site?

8.6


Do individual key personnel maintain go kits (for example USB sticks) with the vital records and forms they need to resume Essential Functions at an alternate location?

8.7

Does the Agency identify the risks involved if the vital records are retained in current locations and media, and the difficulty of reconstituting them if they are destroyed?

8.8

Does the Agency ensure appropriate protections of vital records including the dispersing of those records to other locations?

8.9

Has the Agency developed and maintained a vital records plan packet or collection that contains the necessary keys or access codes, if required, for operations?


8.10

Has the Agency developed and maintained a vital records plan packet or collection that has a listing of the access requirements and sources of equipment necessary to access the records?

8.11

Has the Agency developed and maintained a vital records plan packet or collection that list records recovery experts or vendors?

9.0 HUMAN CAPITAL: Policies, plans, and procedures that address human capital needs during a continuity event, such as guidance on: pay, leave, work scheduling, benefits, telework, hiring, authorities, and flexibilities.

9.1

Does the COOP Plan identify and designate those positions that are required to operate Essential Functions (Key positions)?

9.2


Does the Agency officially inform all continuity personnel of their roles or designations by providing written documentation and trainings to ensure that continuity personnel know and accept their roles and responsibilities?

9.3

Has the Agency established procedures for contacting and accounting for employees in the event of an emergency?

9.4

Do the Agency’s continuity programs, plans, or procedures include or reference agency-specific guidance and direction for continuity personnel on human-capital issues?

9.5

Do the Agency’s continuity personnel annually participate in their agency’s continuity training, testing, and exercise (TT&E) program, as reflected in the Agency’s training


records?

9.6

Does the Agency provide guidance to continuity personnel on individual preparedness measures they should take to ensure response to a continuity event? For example personal and professional go-kits.

9.7

Has the Agency developed a process to communicate instructions with continuity personnel before, during, and after a continuity event?

9.8

Does the Agency have an internal communications and notification plan for all employees? Employees who are not continuity personnel must also be notified.

9.9

Has the Agency developed a process to communicate the Agency’s


operating status with all staff?

9.10

Has the Agency developed a process to communicate their human capital guidance for emergencies (pay, leave, staffing, work scheduling, benefits, telework, hiring authorities, and other human resources flexibilities) to managers and staff?

9.11

Does the COOP Plan ensure support for employees and their families in the event of an emergency? This should include providing guidance to all staff in developing Family Support Plans which will increase personal and family preparedness throughout the Agency and support employee availability during a continuity event.

10.0 TRAINING, TESTING, AND EXERCISE (TT&E) PROGRAM: Identifies, trains, and prepares personnel capable of performing their continuity responsibilities and implementing procedures to support the continuation of the agency's Essential Functions. Training provides the skills and familiarizes personnel with procedures and tasks. Tests and exercises serve to assess and validate all the components of


continuity plans, policies, procedures, systems, and facilities.

10.1

Does the Agency conduct and document annual continuity awareness briefings (or other means of orientation) for the entire workforce?

10.2

Does the Agency conduct and document annual testing of alert, notification, and activation procedures for all continuity personnel?

10.3

Does the Agency conduct and document annual testing of primary and backup infrastructure systems and services (e.g., power, water, fuel) at primary and alternate facilities?

10.4

Does the Agency test and validate equipment to ensure the internal and external interoperability and


viability of communications systems?

10.5

Does the Agency conduct and document annual testing of plans for recovering vital records (both unclassified and classified, if applicable), critical information systems, services, and data?

10.6.1

Does the Agency conduct annual training on the roles and responsibilities for personnel (including host or contractor personnel) who are assigned to activate, support, and sustain continuity operations?

10.6.2

Does the Agency conduct annual training on the roles and responsibilities for personnel (including host or contractor personnel) who are assigned to activate, support, and sustain devolution operations?


10.6.3

Does the Agency conduct annual training on the roles and responsibilities for personnel (including host or contractor personnel) who are assigned to activate, support, and sustain reconstitution plans?

10.6.4

Does the Agency conduct annual training on the roles and responsibilities for personnel involved in the succession order for key Agency personal and Agency heads?

10.7

Does the Agency conduct an annual exercise that demonstrates its familiarity with continuity

plans and procedures and demonstrate the agency’s capability to continue its Essential Functions? This includes the deliberate and preplanned movement of continuity personnel to an alternate facility or


location, and demonstrating internal and external communications

capabilities, as well as backup data and records capabilities, etc.

10.8

Does the Agency conduct a comprehensive debriefing after each exercise, which allows participants to identify systemic weaknesses in plans and procedures and to recommend revisions to the Agency’s continuity plan?

10.9

Does the Agency formally document and report all conducted tests, trainings, and exercises, and their results, as applicable? The exercise, training, or testing date, activities completed, and names/titles of those participating in the training, testing, or exercise should be documented in writing for all continuity TT&E activities.

11.0 DEVOLUTION OF CONTROL AND DIRECTION: The transfer of functions and responsibilities from the primary staff to other


offices/locations and staff. Devolution could also involve transferring specific Essential Functions and roles to other agencies. Devolution occurs when no one at an agency is capable of resuming a specific Essential Function or if an entire agency cannot resume operations within a reasonable amount of time.

11.1

Does the COOP Plan’s Order of Succession for various key personnel include the eventual succession to another employee at a different agency or entity for functions that must continue? Are there any triggers or limits on the devolution?

11.2

Does the COOP Plan require succeeding employees at different agencies or entities be trained on the Agency's plan prior to devolution? This will only apply if the answer to 11.1 is affirmative.

12.0 RECONSTITUTION OPERATIONS: Reconstitution planning is the process by which the agency's personnel resume normal operations from the original or a replacement primary operating facility.

12.1


Does the Agency provide an executable plan for recovering from the effects of an emergency and transitioning back to efficient normal operational status from continuity operations status once a threat or disruption has passed?

12.2

Does the Agency’s COOP Plan or procedures include redeployment plans for phasing down alternate facility operations and returning operations, personnel, records, and equipment to the normal operating facility or to another temporary or permanent primary operating facility, when appropriate?

12.3

Has the Agency developed a plan or procedures to inform all personnel that the actual emergency or threat of an emergency no longer exists?

12.4

Has the Agency developed a plan or procedures to instruct personnel on


how to resume normal operations?

12.5

Has the Agency developed a plan or procedures to supervise a return to the normal operating facility or a move to another temporary or permanent primary operating facility?

12.6

Has the Agency developed a plan or procedures to verify that all systems, communications, and other required capabilities are available and operational again, and that the agency is fully capable of accomplishing all Essential Functions and operations at the restored or new facility?

12.7

Has the Agency developed a plan or procedures to work with its records office (or similar function in the agency) to effectively transition or


recover vital records and databases, as well as other records that have not been designated as vital records, as part of the overall reconstitution effort?


PANDEMIC INFLUENZA ANNEX/CHAPTER CHECKLIST

COOP Element

Location in

the COOP Plan

Reviewers CommentsYes

No

N/A

Recommendations

1

Does the pandemic flu annex (“Annex”) include a reference to the General COOP Plan?

2

Does the Annex include assumptions specific to pandemic planning?

3

Does the Annex include activation policies?

4

Does the Annex or General COOP Plan describe how employees will be


notified about activation?

5

Does the Annex include facility screening policies? Social distancing policies?

6

Does the Annex include workplace hygiene policies?

7

Does the Annex account for various levels of personal protective equipment (PPE) that may be necessary for some of the employees? This may not be necessary for all agencies, other than hand washing and alcohol based hand sanitizer.

8

Does the Annex include Essential Functions that are different from regular COOP planning? This will not apply to all agencies.


9

Does the Annex or the General COOP Plan include Orders of Succession for all key personnel and Agency leadership? Are the succession lists three people deep?

10

Does either the Annex or the General COOP Plan include necessary Delegations of Authority?

11

Does the Annex include the tiered leave policies from the Department of Budget and Management (if applicable)?

12

Does the Annex include a telecommuting chart that lists employees and their telecommuting capabilities (by job function, access to a laptop or PC at home, any limitations, as well as internet access)? The Annex should, at least, list the divisions of employees able to


telecommute.


maryland emergency management agency - continuity of ... · web viewhave all key elements of the...

Documents